CVE-2026-60004 1

CVE-2026-60004: Gitea Code Injection Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Aug 25, 2026

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

Vulnerabilities & Patching